spree_api 6.0.0.rc4 → 6.0.0.rc6

data/app/controllers/spree/api/v3/admin/store_controller.rb

@@ -9,7 +9,7 @@ module Spree
             body.attribute :name, :string, example: 'My Store'
             body.attribute :admin_locale, :string, example: 'en'
             body.attribute :timezone, :string, example: 'Europe/Berlin'
-            body.attribute :weight_unit, :string, choices: Spree::Variant::WEIGHT_UNITS
+            body.attribute :weight_unit, :weight_unit
             body.attribute :unit_system, :string, choices: Spree::Store::UNIT_SYSTEMS
             body.attribute :storefront_access, :string,
               choices: Spree::Channel::Gating::STOREFRONT_ACCESS,
@@ -65,6 +65,13 @@ module Spree
               description: 'Admits a seller as soon as they finish onboarding, with no operator review.'
             body.attribute :auto_approve_seller_products, :boolean,
               description: 'Puts a seller product on sale the moment it is submitted, with no review.'
+            body.attribute :seller_digital_assets_enabled, :boolean,
+              description: 'Lets sellers attach downloadable files to their own products.'
+            body.attribute :seller_digital_asset_content_types, :array, of: :string,
+              example: %w[application/pdf application/zip],
+              description: "The content types a seller's file may have, checked against the file's own signature where it has one. An entry names one type or, with `*` as the subtype, a whole family. The operator's own uploads are not restricted."
+            body.attribute :review_seller_digital_asset_changes, :boolean,
+              description: 'Sends a seller product already on sale back to review when the seller adds or replaces a file on it.'
             body.attribute :send_seller_transactional_emails, :boolean,
               description: 'When false, transactional seller emails (approval, payouts and so on) are not sent.'
             body.attribute :default_commission_tax_rate, :decimal,

data/app/controllers/spree/api/v3/admin/tags_controller.rb

@@ -63,22 +63,24 @@ module Spree
             false
           end
 
-          # Tagging filter. Store-owned taggables (`Spree::Product`,
-          # `Spree::Order`) tenant their taggings by `store_id` via
-          # `acts_as_taggable_tenant`, so their vocabulary is bounded to the
-          # current store with a single indexed `tenant` filter. Global
-          # taggables like the customer/user type carry no store, so their tags
-          # are not store-scoped here.
+          # Tagging filter. A taggable declaring `acts_as_taggable_tenant :store_id`
+          # stores the owning store on each tagging, so its vocabulary is bounded
+          # to the current store with a single indexed `tenant` filter. Taggables
+          # without a store tenant are not store-scoped here.
           def taggings_conditions
             conditions = { taggable_type: taggable_type, context: 'tags' }
             conditions[:tenant] = current_store.id.to_s if store_tenanted_taggable?
             conditions
           end
 
-          # True for taggables whose taggings carry a store `tenant`
-          # (`acts_as_taggable_tenant :store_id`), i.e. store-owned records.
           def store_tenanted_taggable?
-            %w[Spree::Product Spree::Order].include?(taggable_type)
+            taggable_class.try(:tenant_column).to_s == 'store_id'
+          end
+
+          # `taggable_type` is already matched against `Spree.taggable_types`,
+          # so only a registered class name is ever constantized.
+          def taggable_class
+            taggable_type.constantize
           end
 
           # Per-type scope check for API-key principals: a key listing product

data/app/controllers/spree/api/v3/admin/variants_controller.rb

@@ -5,6 +5,30 @@ module Spree
         class VariantsController < ResourceController
           scoped_resource :products
 
+          SALES_CONTEXT = Spree::Api::V3::RequestSchema.shape('VariantSalesContextParams') do |query|
+            query.attribute :order_id, :id,
+              description: 'A draft order to sell to: lists only what its buyer can be sold on its channel, ' \
+                           'priced in its market. Needs `read_orders`, and cannot be combined with the fields below.'
+            query.attribute :market_id, :id,
+              description: 'Prices in this market and lists only variants with a price in its currency.'
+            query.attribute :channel_id, :id,
+              description: 'Lists only variants published on this channel. When a market, customer, company or ' \
+                           "currency is given without it, the store default channel applies; an order uses its own."
+            query.attribute :customer_id, :id,
+              description: "Narrows to the customer's catalogs and prices as they would pay. Needs `read_customers`."
+            query.attribute :company_id, :id,
+              description: "Narrows to the company's catalogs and prices under its agreement. Needs `read_customers`."
+            query.attribute :currency, :currency,
+              description: 'Lists only variants with a price in this currency. ' \
+                           "With `market_id` it must be the market's currency."
+          end
+          SALES_CONTEXT_PARAMS = (SALES_CONTEXT.fields.keys - [:order_id]).freeze
+
+          # A draft order's item picker asks with the order's market, channel and
+          # buyer, so it lists only what that buyer can be sold there, priced as
+          # they would pay.
+          before_action :load_sales_context, only: :index
+
           protected
 
           def model_class
@@ -19,7 +43,21 @@ module Spree
           # relation from scratch dropped `scope_includes`, so every listed
           # variant fell back to per-row price and stock queries.
           def scope
-            super.eligible.accessible_by(current_ability, ability_action_for_request)
+            variants = super.eligible.accessible_by(current_ability, ability_action_for_request)
+            @sales_context ? variants.where(id: @sales_context.sellable_variants.select(:id)) : variants
+          end
+
+          def serializer_params
+            return super unless @sales_context
+
+            super.merge(
+              currency: @sales_context.currency,
+              user: @sales_context.customer,
+              company: @sales_context.company,
+              market: @sales_context.market,
+              channel: @sales_context.channel,
+              country: @sales_context.country
+            )
           end
 
           # `active_stock_reservations` rides along with the stock levels:
@@ -33,6 +71,63 @@ module Spree
               { primary_media: [{ attachment_attachment: :blob }, { poster_attachment: :blob }] }
             ]
           end
+
+          private
+
+          def load_sales_context
+            requested = SALES_CONTEXT_PARAMS.select { |key| params[key].present? }
+            return if requested.empty? && params[:order_id].blank?
+
+            permission = required_sales_context_permission
+            return render_missing_permission(permission) if permission && !holds_permission?(permission)
+
+            if params[:order_id].present?
+              return refuse_order_with_context(requested) if requested.any?
+
+              @sales_context = Spree::SalesContext.from_order(context_order)
+            else
+              @sales_context = requested_sales_context
+              render_errors(@sales_context.errors) unless @sales_context.valid?
+            end
+          end
+
+          # An order already fixes its market, channel, buyer and currency, so
+          # naming them too could only disagree with it.
+          def refuse_order_with_context(requested)
+            render_error(
+              code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:parameter_invalid],
+              message: I18n.t('spree.api.errors.order_sales_context_exclusive', params: requested.join(', ')),
+              status: :unprocessable_content,
+              details: { order_id: requested.map(&:to_s) }
+            )
+          end
+
+          def required_sales_context_permission
+            return 'read_orders' if params[:order_id].present?
+
+            'read_customers' if params[:customer_id].present? || params[:company_id].present?
+          end
+
+          def requested_sales_context
+            Spree::SalesContext.new(
+              store: current_store,
+              market: find_requested(current_store.markets, :market_id),
+              channel: find_requested(current_store.channels, :channel_id),
+              customer: find_requested(
+                Spree.customer_class.for_store(current_store).accessible_by(current_ability, :show), :customer_id
+              ),
+              company: find_requested(current_store.companies, :company_id),
+              currency: params[:currency]
+            )
+          end
+
+          def find_requested(relation, key)
+            relation.find_by_prefix_id!(params[key]) if params[key].present?
+          end
+
+          def context_order
+            current_store.orders.accessible_by(current_ability, :show).find_by_prefix_id!(params[:order_id])
+          end
         end
       end
     end

data/app/controllers/spree/api/v3/admin/webhook_endpoints_controller.rb

@@ -21,7 +21,7 @@ module Spree
               description: 'Defaults to true on create. Prefer the disable and enable endpoints to pause one.'
             body.attribute :subscriptions, :array, of: :string,
               example: %w[order.placed order.canceled],
-              description: 'Event names this endpoint receives. An empty list or `["*"]` subscribes to every event; otherwise list exact names (`order.completed`) or patterns (`order.*`).'
+              description: 'Event names this endpoint receives. An empty list or `["*"]` subscribes to every event; otherwise list exact names (`order.completed`) or patterns with `*` in place of a segment (`order.*`, `*.created`). At most 200 entries of up to 100 characters.'
           end
 
           request_params 'WebhookEndpointDisableParams', action: :disable do |body|
@@ -112,8 +112,11 @@ module Spree
             )
           end
 
+          # Checked after the model's normalization, so what the gate sees is
+          # exactly what would be stored.
           def requested_credential_events
-            Spree::Events.catalog.credential_events(Array(permitted_params[:subscriptions]))
+            subscriptions = Spree::WebhookEndpoint.normalize_value_for(:subscriptions, permitted_params[:subscriptions])
+            Spree::Events.catalog.credential_events(subscriptions)
           end
 
           def repointed_credential_events

data/app/controllers/spree/api/v3/oauth/authorizations_controller.rb

@@ -44,15 +44,26 @@ module Spree
           # and the merchant would approve on the wrong one.
           def consent_url
             query = params.permit(*FORWARDED_PARAMETERS).to_h.compact_blank.to_query
-            base = Spree::Stores::DashboardUrl.call(store: consent_store)
+            base = Spree::Stores::DashboardUrl.call(store: current_store)
 
-            "#{base}/#{consent_store.prefixed_id}/oauth/authorize?#{query}"
+            "#{base}/#{current_store.prefixed_id}/oauth/authorize?#{query}"
           end
 
-          # @return [Spree::Store]
-          def consent_store
-            @consent_store ||=
-              Spree::OauthApplication.find_by(uid: params[:client_id])&.store || current_store
+          # The client's store wins over the hostname's, and is looked up
+          # before the hostname is resolved at all: resolving it assigns the
+          # default store to Spree::Current, and an app scoping queries by
+          # that store would then never find another store's client.
+          #
+          # @return [Spree::Store, nil]
+          def current_store
+            @current_store ||= client_application&.store || super
+          end
+
+          # @return [Spree::OauthApplication, nil]
+          def client_application
+            return if params[:client_id].blank?
+
+            Spree::OauthApplication.find_by(uid: params[:client_id])
           end
         end
       end

data/app/controllers/spree/api/v3/resource_controller.rb

@@ -248,8 +248,11 @@ module Spree
         end
 
         # Finds a single resource within scope using prefixed ID
+        # Loaded through the lazy-preload relation, as the collection is, so
+        # the serializer's walk over the record's children batches their
+        # associations instead of querying once per child.
         def find_resource
-          scope.find_by_prefix_id!(params[:id])
+          scope.preload_associations_lazily.find_by_prefix_id!(params[:id])
         end
 
         # Per-record authorization hook. A no-op in the shared base: the Store
@@ -481,13 +484,23 @@ module Spree
           base_scope = if @parent.present?
                          @parent.send(parent_association)
                        else
-                         model_class.for_store(current_store)
+                         store_scope
                        end
           base_scope = base_scope.includes(scope_includes) if scope_includes.any?
           base_scope = base_scope.preload_associations_lazily
           model_class.include?(Spree::TranslatableResource) ? base_scope.i18n : base_scope
         end
 
+        # The store's rows of this model when the resource has no parent. A
+        # model the store reaches through another record rather than an
+        # association of its own — a commission line through its order —
+        # names that path here, since `for_store` answers nothing for it.
+        #
+        # @return [ActiveRecord::Relation]
+        def store_scope
+          model_class.for_store(current_store)
+        end
+
         # Action names treated as reads. Override in subclasses with custom
         # read-only member/collection actions (e.g. add `analytics`, `types`)
         # so they map to the `:show` ability instead of a write.
@@ -559,7 +572,17 @@ module Spree
         # declared on the model. Override +resource_permitted_attributes+ rather
         # than this, so the extension union is not lost.
         def permitted_attributes
-          resource_permitted_attributes + model_additional_permitted_attributes
+          with_nested_additional_permitted_attributes(resource_permitted_attributes) + model_additional_permitted_attributes
+        end
+
+        # Nested lists this resource writes, keyed by param name, mapped to the
+        # model each entry becomes — +{ media: Spree::Media }+ lets an
+        # extension's +Spree::Media.additional_permitted_attributes+ ride the
+        # product's +media+ entries, not only the media endpoint.
+        #
+        # @return [Hash{Symbol => Class}]
+        def nested_permitted_models
+          {}
         end
 
         # The resource's writable attributes: its `request_params`
@@ -580,13 +603,33 @@ module Spree
         def model_additional_permitted_attributes
           return [] unless respond_to?(:model_class, true)
 
-          model = model_class
-          return [] unless model.respond_to?(:additional_permitted_attributes)
-
-          Array(model.additional_permitted_attributes)
+          additional_permitted_attributes_for(model_class)
         rescue NotImplementedError
           []
         end
+
+        # What extensions declared writable on +model+. `Spree.base_class` is
+        # host-overridable, so the class_attribute may not be there at all.
+        #
+        # @param model [Class]
+        # @return [Array]
+        def additional_permitted_attributes_for(model)
+          Array(model.try(:additional_permitted_attributes))
+        end
+
+        def with_nested_additional_permitted_attributes(attributes)
+          return attributes if nested_permitted_models.empty?
+
+          attributes.map do |attribute|
+            next attribute unless attribute.is_a?(Hash)
+
+            attribute.to_h do |name, nested|
+              model = nested_permitted_models[name.to_sym]
+              additional = model ? additional_permitted_attributes_for(model) : []
+              [name, additional.any? && nested.is_a?(Array) ? nested + additional : nested]
+            end
+          end
+        end
       end
     end
   end

data/app/controllers/spree/api/v3/seller/auth_controller.rb

@@ -52,6 +52,8 @@ module Spree
             return render_authentication_failed(result.error) unless result.success?
 
             user = result.value
+            return render_account_deactivated if account_deactivated?(user)
+
             # A store's own staff share this user class, so authenticating is
             # not enough: without a role on some seller there is no panel to
             # sign in to, and minting a token would hand out an audience the
@@ -101,6 +103,14 @@ module Spree
             end
 
             user = refresh_token.user
+            # Deactivating deletes the account's refresh tokens; this catches a
+            # refresh already under way when that happened.
+            if account_deactivated?(user)
+              refresh_token.destroy
+              clear_refresh_cookie
+              return render_account_deactivated
+            end
+
             # Membership can be revoked while a session is live; the refresh is
             # where that takes effect.
             unless user.seller_member?

data/app/controllers/spree/api/v3/seller/invitation_acceptances_controller.rb

@@ -46,6 +46,8 @@ module Spree
 
             user = resolve_or_create_invitee(@invitation)
             return if performed?
+            # Checked before accepting: a deactivated account gains no role.
+            return render_account_deactivated if account_deactivated?(user)
 
             @invitation.invitee = user
             result = Spree.invitation_accept_workflow.call(invitation: @invitation)

data/app/controllers/spree/api/v3/seller/me_controller.rb

@@ -58,6 +58,10 @@ module Spree
             {
               user: Spree.api.seller_account_serializer.new(current_user, params: serializer_params).to_h,
               sellers: serialized_sellers,
+              # The marketplace's own settings that shape what the panel lets a
+              # seller do, read before any seller is chosen since there is one
+              # store per installation.
+              store: Spree.api.seller_store_serializer.new(serializer_params[:store], params: serializer_params).to_h,
               # Both shapes, exactly as the admin `/me`: the panel's `<Can>`
               # reads CanCanCan rules, the key gate reads keys. Sending only
               # keys left `<Can>` answering false for everything on the seller

data/app/controllers/spree/api/v3/seller/orders_controller.rb

@@ -84,7 +84,7 @@ module Spree
               )
 
               if result.success?
-                render json: serialize_resource(@resource.reload)
+                render json: serialize_resource(reloaded_resource)
               else
                 render_service_error(@resource.errors.presence || result.error)
               end
@@ -115,7 +115,7 @@ module Spree
               next render_validation_error(invalid.errors) if invalid
 
               if @resource.update(addresses)
-                render json: serialize_resource(@resource.reload)
+                render json: serialize_resource(reloaded_resource)
               else
                 render_validation_error(@resource.errors)
               end
@@ -143,12 +143,20 @@ module Spree
             super.not_drafts
           end
 
+          # Both addresses are named because they are two associations on one
+          # table, so a row that reads them separately costs a lookup each.
           def collection_includes
-            [:line_items, :customer, :channel]
+            [:line_items, :customer, :channel, :bill_address, :ship_address]
           end
 
           private
 
+          # Read back as #show reads it, lazily preloading, so its
+          # fulfillments' rates and methods load once rather than per row.
+          def reloaded_resource
+            scope.preload_associations_lazily.find(@resource.id)
+          end
+
           # Either address, as a correction rather than a replacement: the
           # sent fields are laid over what the order already holds, so a
           # request naming one line does not blank out the country and

data/app/controllers/spree/api/v3/seller/package_types_controller.rb

@@ -28,12 +28,12 @@ module Spree
             body.attribute :length, :number, nullable: true
             body.attribute :width, :number, nullable: true
             body.attribute :height, :number, nullable: true
-            body.attribute :dimensions_unit, :string, nullable: true, choices: Spree::Variant::DIMENSION_UNITS
+            body.attribute :dimensions_unit, :dimension_unit, nullable: true
             body.attribute :weight, :number,
               nullable: true,
               description: "The empty package's own weight, added to every quote."
             body.attribute :max_weight, :number, nullable: true
-            body.attribute :weight_unit, :string, nullable: true, choices: Spree::Variant::WEIGHT_UNITS
+            body.attribute :weight_unit, :weight_unit, nullable: true
             body.attribute :default, :boolean,
               description: "Makes this the box this seller's parcels are quoted with. One default per seller, so it never displaces the marketplace's."
             body.attribute :metadata, :hash, nullable: true

data/app/controllers/spree/api/v3/seller/password_resets_controller.rb

@@ -43,7 +43,8 @@ module Spree
             # admin who runs no seller has no panel to be sent to, and mailing
             # them a seller reset link would be an invitation to a session they
             # cannot hold.
-            if user&.seller_member?
+            # A deactivated account is treated as no account: no email is sent.
+            if user&.seller_member? && !account_deactivated?(user)
               user.publish_event(RESET_REQUESTED_EVENT, event_payload(user))
             end
 
@@ -60,6 +61,9 @@ module Spree
             # it can be revoked between the email being sent and the link being
             # opened, and signing in is what the success path does.
             return render_token_invalid unless user&.seller_member?
+            # A link sent before the account was switched off must not change
+            # its password or sign it in.
+            return render_account_deactivated if account_deactivated?(user)
 
             unless user.update(password: params[:password], password_confirmation: params[:password_confirmation])
               return render_errors(user.errors)

data/app/controllers/spree/api/v3/seller/products/digital_assets_controller.rb

@@ -0,0 +1,67 @@
+module Spree
+  module Api
+    module V3
+      module Seller
+        module Products
+          # The downloadable files on one of this seller's own products.
+          #
+          # Uploaded files only: a provider is the operator's own code
+          # reaching into their internal systems, so a seller can neither pick
+          # one nor read its settings. An asset the operator set up with one
+          # is still listed, since it is part of what the seller's product
+          # delivers.
+          #
+          # The marketplace's rules for a seller's file — whether sellers may
+          # upload at all, which content types, and whether an approved
+          # listing goes back to review — apply because the workflow is told
+          # who is writing.
+          class DigitalAssetsController < Seller::ResourceController
+            include Spree::Api::V3::DigitalAssetsResource
+
+            scoped_resource :products
+
+            request_params :digital_asset do |body|
+              body.include_attributes Spree::Api::V3::DigitalAssetRequestSchema
+              body.require_attributes :signed_id, on: :create
+            end
+
+            # DELETE /api/v3/seller/products/:product_id/digital_assets/:id
+            #
+            # Removing a file is covered by the same switch as adding one: a
+            # marketplace that keeps digital files to itself keeps the ones it
+            # attached to a seller's product.
+            def destroy
+              unless current_store.preferred_seller_digital_assets_enabled
+                return render_validation_error(I18n.t('spree.digital_assets_sellers_disabled'))
+              end
+
+              super
+            end
+
+            protected
+
+            def serializer_class
+              Spree.api.seller_digital_asset_serializer
+            end
+
+            def create_workflow_arguments
+              super.merge(seller: current_seller, submitted_by: current_user)
+            end
+
+            def update_workflow_arguments
+              super.merge(seller: current_seller, submitted_by: current_user)
+            end
+
+            # Rooted in the seller's own catalog, so another seller's product
+            # is a 404. Changing a product's files is a change to the product,
+            # so writes need `:update` on it, not just `:show`.
+            def set_parent
+              @parent = current_seller.products.find_by_prefix_id!(params[:product_id])
+              authorize_parent!(@parent)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/seller/products_controller.rb

@@ -41,19 +41,6 @@ module Spree
             'archived' => -> { Spree.product_archive_workflow }
           }.freeze
 
-          # The operator's price shape, except `currency` may be left out: the
-          # store's currency is assumed (see `default_price_currencies`).
-          PRICE = Spree::Api::V3::RequestSchema.new do |schema|
-            schema.attribute :currency, :currency,
-              example: 'USD',
-              description: "Omit to price in the store's currency. A seller has no currency of their own."
-            schema.attribute :amount, :decimal,
-              required: true,
-              example: '24.00',
-              description: 'A canonical decimal string (`"1234.56"`: period decimal, no grouping). The API does not parse localized input.'
-            schema.attribute :compare_at_amount, :decimal, nullable: true, example: '30.00'
-          end
-
           scoped_resource :products
 
           request_params :product do |body|
@@ -69,7 +56,7 @@ module Spree
               description: "The marketplace's product type this product is listed against, from the product types endpoint. Null detaches it. Saving with a type seeds its option types onto the product."
             body.attribute :delivery_profile_id, :id,
               description: "Which of the marketplace's delivery profiles the product ships under. A new product sent without one lands on the profile marked default."
-            body.attribute :prices, :array, of: PRICE,
+            body.attribute :prices, :array, of: Spree::Api::V3::Seller::PriceRequestSchema,
               description: "Shorthand for a simple (no-options) product: per-currency prices that forward to the product's sole variant."
             # `external_url` stays out for the same reason it does on the
             # operator's endpoint: it would make the server fetch a URL the
@@ -83,56 +70,11 @@ module Spree
               media_item.attribute :variant_ids, :array, of: :id,
                 description: 'Replaces the variants this media is linked to. An empty list clears them.'
             end
-            # Narrower than the operator's variant set: `seller_id` would let a
-            # payload hand a variant to somebody else, and
-            # `tax_category_id`/`delivery_profile_id` are marketplace
-            # configuration.
             body.attribute :variants, :array,
-              as: 'SellerProductVariantParams',
+              as: 'ProductVariantParams',
               description: 'The variants, as a whole: one absent from the list is removed. Pass `id` to update an existing variant.' do |variant|
+              variant.extends Spree::Api::V3::Seller::VariantRequestSchema
               variant.attribute :id, :id
-              variant.attribute :sku, :string
-              variant.attribute :barcode, :string
-              variant.attribute :cost_price, :decimal, nullable: true
-              variant.attribute :cost_currency, :currency
-              variant.attribute :weight, :number, nullable: true
-              variant.attribute :height, :number, nullable: true
-              variant.attribute :width, :number, nullable: true
-              variant.attribute :depth, :number, nullable: true
-              variant.attribute :weight_unit, :string, choices: Spree::Variant::WEIGHT_UNITS
-              variant.attribute :dimensions_unit, :string, choices: Spree::Variant::DIMENSION_UNITS
-              variant.attribute :hs_code, :string
-              variant.attribute :customs_description, :string
-              variant.attribute :country_of_origin, :country
-              variant.attribute :minimum_order_quantity, :integer, nullable: true
-              variant.attribute :order_multiple, :integer, nullable: true
-              variant.attribute :purchase_unit, :string
-              variant.attribute :units_per_carton, :integer,
-                nullable: true,
-                description: 'How many units fill one carton.'
-              variant.attribute :carton_package_type_id, :id,
-                nullable: true,
-                description: 'The carton this variant is packed into: a package type of kind `carton`.'
-              variant.attribute :carton_weight, :number,
-                nullable: true,
-                description: "What one packed carton weighs, in the variant's weight unit."
-              variant.attribute :cartons_per_pallet, :integer,
-                nullable: true,
-                description: 'How many cartons stack on one pallet.'
-              variant.attribute :track_inventory, :boolean
-              variant.attribute :preorderable, :boolean
-              variant.attribute :preorder_ships_at, :datetime,
-                nullable: true,
-                description: 'The "ships by" date shown to customers while the variant is a pre-order. Null clears it.'
-              variant.attribute :backorder_limit, :integer,
-                nullable: true,
-                description: 'Maximum units sellable beyond available stock, capping backorders and pre-orders. Null is unlimited.'
-              variant.attribute :position, :integer
-              variant.attribute :options, :array, of: Spree::Api::V3::VariantOptionRequestSchema,
-                description: 'One pair per option type the variant takes part in (size, color).'
-              variant.attribute :prices, :array, of: PRICE, description: 'Per-currency prices. Upserted by currency.'
-              variant.attribute :stock_levels, :array, of: Spree::Api::V3::StockLevelRequestSchema,
-                description: "Stock per location, at this seller's own locations only: a location belonging to anyone else is ignored."
             end
           end
 
@@ -200,8 +142,10 @@ module Spree
                                                   submitted_by: try_spree_current_user)
 
               # A product Propose refused is untouched; one it accepted is in
-              # review or already through it.
-              product.reload.status != was
+              # review or already through it. The saved value, not the
+              # attribute: a refused update leaves the new status unsaved on
+              # the record, and a rolled-back one restores what was stored.
+              product.status_in_database != was
             }
           end
 
@@ -270,6 +214,10 @@ module Spree
             Spree.product_update_workflow
           end
 
+          def nested_permitted_models
+            { media: Spree::Media, variants: Spree::Variant }
+          end
+
           # The workflow builds its own product, which would leave a seller's
           # listing unowned. Handing it one built through `current_seller.products`
           # keeps the seller on the record, whatever the payload claims.

data/app/controllers/spree/api/v3/seller/resource_controller.rb

@@ -69,12 +69,8 @@ module Spree
           # What extensions opened to sellers, never the operator-level list:
           # an attribute opened to operators must not become seller-writable
           # by accident.
-          def model_additional_permitted_attributes
-            return [] unless respond_to?(:model_class, true)
-
-            Array(model_class.try(:additional_seller_permitted_attributes))
-          rescue NotImplementedError
-            []
+          def additional_permitted_attributes_for(model)
+            Array(model.try(:additional_seller_permitted_attributes))
           end
 
           def authorize_resource!(resource = @resource, action = action_name.to_sym)

data/app/controllers/spree/api/v3/seller/team_controller.rb

@@ -86,7 +86,7 @@ module Spree
           private
 
           def members
-            @members ||= current_seller.users.to_a
+            @members ||= current_seller.users.with_attached_avatar.to_a
           end
 
           def set_member